CVE

Id
93671  
CVE No.
CVE-2016-6851  
Status
Candidate  
Description
An issue was discovered in Open-Xchange OX Guard before 2.4.2-rev5. Script code can be provided as parameter to the OX Guard guest reader web application. This allows cross-site scripting attacks against arbitrary users since no prior authentication is needed. Malicious script code can be executed within a user"s context. This can lead to session hijacking or triggering unwanted actions via the web interface (sending mail, deleting data etc.) in case the user has an active session on the same domain already.  
Phase
Assigned (20160818)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
794286 93671 CVE-2016-6851 EXPLOIT-DB:40377  View
794287 93671 CVE-2016-6851 URL:https://www.exploit-db.com/exploits/40377/  View
794288 93671 CVE-2016-6851 CONFIRM:http://packetstormsecurity.com/files/138701/Open-Xchange-Guard-2.4.2-Cross-Site-Scripting.html  View
794289 93671 CVE-2016-6851 CONFIRM:http://www.securityfocus.com/archive/1/archive/1/539395/100/0/threaded  View
794290 93671 CVE-2016-6851 BID:92920  View

Related JVN